My Mozilla coworkers Ben Kero and Dan Maher gave a standing-room only presentation at Linux Conf AU about How to Use Puppet Like an Adult. It was fantastic!
Data != logic
Business DATA does not belong in modules, but business LOGIC is OK.
What are the data sources, then?
Hiera lightweight pluggable, hierarchical databases. External to the modules, you can use many backends, including MySQL. New feature, standard in puppet 3.0. If you like YAML (and you should), youll like this.
$var = lookup('something') # unscoped (complicated)
$var = lookup('namespace::something') # scoped (yay!)
Another data source is puppetdb. This is a bigger topic, but the important thing is that it can be used for high performance store configs.
Where to find pre-built modules for puppet?
Github
Puppet Forge
Or you can write your own module
.but dont waste time building your own, say, Apache modulesomeone else has a better one out there.
Is that module right for me?
What to check:
OS/distribution
Complexity Can you read the module and understand what it does? If not, this might not be the module for you.
Popularity the more people using/forking it, the more support is probably around. Also age of last commit.
Whats the documentation like?
Recommended pre-built modules these work, and theyre good. Analyze how they work and learn from them:
puppetlabs/firewall
puppetlabs/cloud_provisioner
When rolling your own modules if this is going to be a one-off, do whatever you want. If you want to make it open source, know that someone else will use it, and make it more generic.
Use parameterized classes. This allowed you to separate your business data from your business logic. You can avoid having passwords, ssh keys, etc in there, and then you CAN open source it.
Make sure its documented.
Module template
puppet module generate author-mod_name gets you all the files you need with the necessary templares (e.g. README has the sections you need).
Note: Everybody should be doing spec testing, not just puppet..
Parameterized classes
Similar to definitions they are passed in data. Its how to separate data from logic. If you dont get anything else, get this:
These help you write your manifest one time for different nodes. If you have 10 web servers with different node names, write one manifest, and use logic and parameterized classes to instantiate that manifest 10 times. Dont write 10 manifests.
USE A STYLE GUIDE
Who here has written Perl code? Who here has written Perl code that someone else can read? USE A STYLE GUIDE
Parser Validation
just run:
$ puppet parser validate manifest.pp
Put this into your commit hook, so that parser errors dont get committed.
Linting
A way of making sure code meets the style guide. External tool, but stable. Very customizable, you can use your own style guide, and you can have it ignore certain things (e.g. dont care about quoting everything, so dont error on that). You can put this into commit hooks too.
puppet-concat
Dynamically build files out of lots of parts. How you can build good config files for daemons that dont support .d directories. Assume you have puppet-concat installed already, its widely used, because pre-built modules use it too.
stdlib
Put out by puppetlabs, not actually part of the standard library, but contains lots of useful functions. This is also widely used. Can check if the variable is boolean, integer, strings, can collide hashes together, can check functions, etc.
Sanity preservation
Set default values for your variables make sure theyre sane you can pull variables out of facter.
Verify content play it safe, dont blithely act on user data. You can throw an error (e.g. if you have a string instead of an integer)
Mutually exclusive declarations ensure when you start navigating down one logical path, it cant go down the other path. This comes down to if/then programming, makes more layers to your manifest, but you can make accurate statements about what you want the module to do and predict what it WONT do. Being able to predict what puppet will and wont do is important.
Useful Log Output
Functions for each log level
e.g. notice(); warn(); err();
Make these informative and human-readable. What broke and why, can other people understand whats going on with this?
Puppet As a Source of Truth
Build an ecosystem around puppet. The more you use puppet, the more it describes your infrastructure. How do you do this, though?
You can use the puppet data library (PDL) a collection of services with an API so you can query puppet from other services e.g. inventory system, dashboard, etc. You can also use it from within puppet.
You can build an inventory service to know all the facter information about all the machines. You can use the run report service for dashboards like puppetdashboard.
You can download a .dat file and visualize it with graphviz to see how your logic paths look. This .dat file comes within puppet (you do gem install puppet and then puppet with some options and you can get it).
The take-home:
